<html><body><span style="font-family:Verdana; color:#000000; font-size:10pt;"><div>Yes - from what I can tell, we can set up specific pages on the wiki for public read-only access.<br></div><div><br></div><div>Wayne</div><div><br><br></div>
<blockquote id="replyBlockquote" webmail="1" style="border-left: 2px solid blue; margin-left: 8px; padding-left: 8px; font-size:10pt; color:black; font-family:verdana;">
<div id="wmQuoteWrapper">
-------- Original Message --------<br>
Subject: Re: [cabfpub] Questions about [70] EV Code Signing Identifier<br>
From: "Ben Wilson" <<a href="mailto:ben@digicert.com">ben@digicert.com</a>><br>
Date: Fri, June 08, 2012 11:53 am<br>
To: "'Rick Andrews'" <<a href="mailto:Rick_Andrews@symantec.com">Rick_Andrews@symantec.com</a>>, <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>
<br>
<style>
#wmQuoteWrapper /* Font Definitions */ @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;}
#wmQuoteWrapper @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;}
#wmQuoteWrapper /* Style Definitions */ p.MsoNormal, #wmQuoteWrapper li.MsoNormal, #wmQuoteWrapper div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman","serif";}
#wmQuoteWrapper a:link, #wmQuoteWrapper span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;}
#wmQuoteWrapper a:visited, #wmQuoteWrapper span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;}
#wmQuoteWrapper p.emailquote, #wmQuoteWrapper li.emailquote, #wmQuoteWrapper div.emailquote {mso-style-name:emailquote; mso-margin-top-alt:auto; margin-right:0in; mso-margin-bottom-alt:auto; margin-left:1.0pt; border:none; padding:0in; font-size:12.0pt; font-family:"Times New Roman","serif";}
#wmQuoteWrapper span.EmailStyle18 {mso-style-type:personal-reply; font-family:"Calibri","sans-serif"; color:#1F497D;}
#wmQuoteWrapper .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;}
#wmQuoteWrapper @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;}
#wmQuoteWrapper div.WordSection1 {page:WordSection1;}
#wmQuoteWrapper /* List Definitions */ @list l0 {mso-list-id:1903905772; mso-list-template-ids:154197384;}
#wmQuoteWrapper @list l0:level1 {mso-level-number-format:alpha-lower; mso-level-tab-stop:.5in; mso-level-number-position:left; text-indent:-.25in;}
#wmQuoteWrapper ol {margin-bottom:0in;}
#wmQuoteWrapper ul {margin-bottom:0in;}
</style><div class="WordSection1"><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Tim is out, and I will update it today. However, we have discussed in the past similar issues about a public wiki. Do we have that capability to create wiki pages that are public? <o:p></o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></div><div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"><div class="MsoNormal" style="font-size:12pt;"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Rick Andrews<br><b>Sent:</b> Friday, June 08, 2012 12:36 PM<br><b>To:</b> <a href="mailto:public@cabforum.org">public@cabforum.org</a><br><b>Subject:</b> [cabfpub] Questions about [70] EV Code Signing Identifier<o:p></o:p></span></div></div></div><div class="MsoNormal" style="font-size:12pt;"><o:p> </o:p></div><div><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">I have a few questions about this ballot. I apologize for not bringing this up during the review period, but you often don’t see things until you’re trying to implement...<o:p></o:p></span></div></div><div><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""> <o:p></o:p></span></div></div><div><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">First of all, I haven’t been able to find a concise list on the wiki of what is the current status of each ballot. I assume someone maintains that list, but it would be nice to see it on one page.<o:p></o:p></span></div></div><div><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""> <o:p></o:p></span></div></div><div><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Secondly, a few questions have come up about the construction of the permanentIdentifier. Here’s the current text:<o:p></o:p></span></div></div><div style="margin-top:5.0pt;margin-bottom:5.0pt"><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;color:#0070C0">"(B) the Certificate MUST include a SubjectAltName:permanentIdentifier which MUST contain the following: </span><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></div></div><div style="margin-top:5.0pt;margin-bottom:5.0pt"><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;color:#0070C0">"(1) The ISO 3166-2 country code in uppercase characters corresponding to the Subject’s Jurisdiction of Incorporation or Registration (CC), as specified in the subject:jurisdictionOfIncorporationCountryName field; </span><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></div></div><div style="margin-top:5.0pt;margin-bottom:5.0pt"><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;color:#0070C0">"(2) If applicable, the state, province, or locality of the Subject’s Jurisdiction of Incorporation in uppercase characters as specified in the subjectjurisdictionOfIncorporationLocalityName or subject:jurisdictionofIncorporationStateorProvinceName field, expressed in an unabbreviated format (STATE); and </span><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></div></div><div style="margin-top:5.0pt;margin-bottom:5.0pt"><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;color:#0070C0">"(3) The first one of the following that applies: a. The Registration Number as included in the Subject:serialNumber field (REG), b. A date of Incorporation or Registration in YYYY-MM-DD format (DATE) and the Subject’s Organization Name as included in the organizationName field (ORG), c. A verifiable date of creation in YYYY-MM-DD format (DATE) and the Subject’s Organization Name as included in the organizationName field (ORG), or d. The Subject’s Organization Name as included in the organizationName field (ORG). </span><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></div></div><div style="margin-top:5.0pt;margin-bottom:5.0pt"><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;color:#0070C0">"The CA SHALL format data in the SubjectAltName:permanentIdentifier extension using Unicode as follows: CC-STATE (if applicable)- REG or DATE (if available)-ORG (if REG is not present). Characters representing the organization name MUST be uppercase Unicode. Any included “-“ characters MUST be Unicode 002D and any included spaces in REG, STATE, or ORG MUST be Unicode 0020. A CA MAY truncate or abbreviate an organization name included in this field to ensure that the combination does not exceed 64 characters provided that the CA checks this field in accordance with section 10.11.1 and a Relying Party will not be misled into thinking that they are dealing with a different organization. If this is not possible, the CA MUST NOT issue the EV Code Signing Certificate.</span><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></div></div><ol start="1" type="a"><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Since the STATE part is “if applicable”, what happens if the STATE is not applicable? Is the permanentIdentifier “CC--REG or DATE”?<o:p></o:p></span></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Can a State or Province include a hyphen? If so, I would expect it would need to be escaped somehow so as not to be interpreted as a delimiter.<o:p></o:p></span></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">Same question about Org, except that I know that Orgs can contain hyphens (e.g., “Hewlett-Packard”).<o:p></o:p></span></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">We don’t understand the need to allow the CA to truncate so the combination doesn’t exceed 64 characters. That’s the max length of DN components, but this is an extension. If the intent is to insure that any CA would come up with the same combination for a given organization, this seems to allow for variability that will cause incompatibilities.<o:p></o:p></span></li></ol><div><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""> <o:p></o:p></span></div></div><div><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif"">-Rick<o:p></o:p></span></div></div><div><div class="MsoNormal" style="font-size:12pt;"><span style="font-size:10.0pt;font-family:"Calibri","sans-serif""> <o:p></o:p></span></div></div></div><hr>_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="http://cabforum.org/mailman/listinfo/public">http://cabforum.org/mailman/listinfo/public</a><br>
</div>
</blockquote></span></body></html>